Address Poisoning and Clipboard Hijacking: Check Every Character

Here are two USDT addresses on the TRON network. Are they the same?

TXk4Ra9vQe7mLz2PbW8sNcY3dFh6JtUu5K
TXk4R8nWq3cJ7xGd2KmYp6sVbH9eFtUu5K

They aren't. Both are made up for this example, and they share only the first five and last five characters. Yet shortened the way many wallets display addresses, both read TXk4R...tUu5K. If you only ever glance at the ends, you'd never spot the swap.

That small gap between what you check and what you send is where two of the sneakiest crypto scams live. Neither needs your password, your seed phrase or your phone. They just need you to be in a hurry.

Scam one: address poisoning

Blockchains are public, so anyone can watch which addresses you send money to. Address poisoners run bots that do exactly that.

Say Halima pays a supplier in USDT every couple of weeks. The bot sees the payment, then generates an address that starts and ends with the same characters as the supplier's. From that lookalike, it sends Halima's wallet a tiny amount of crypto, or a worthless token named to look like USDT. On some networks it can even create an entry that appears to show Halima sending zero tokens to the lookalike.

Now the fake sits in Halima's transaction history, right next to the real one. Two weeks later, in a rush between meetings, Halima opens the history, copies "the supplier's address" from the most recent entry and pays the scammer.

Nothing was hacked. The history was simply poisoned.

Scam two: clipboard hijacking

Clipboard hijackers, sometimes called clippers, are malware. They sit quietly on a phone or computer and watch what you copy. When they see something shaped like a crypto address, they replace it with the attacker's address. You copy the right address and paste the wrong one.

They usually arrive with things that seemed like a bargain: cracked software, pirated games, "modded" apps, APK files shared in chats and dodgy browser extensions. The cleverer ones paste a lookalike rather than a random address, which is why a quick glance isn't enough. Our guide to spotting fake crypto apps covers how to keep that kind of software off your phone.

The four-check routine

Do this before every transfer. After a week it takes about thirty seconds.

1. Copy from the source, every time. Take the address from the recipient's deposit screen, their invoice, or a saved and labelled entry in your address book. Never copy it from your transaction history, a block explorer or an old chat.
2. Paste, then compare the start, the end and the middle. Check at least the first six and last six characters, plus a chunk from the middle, against the source. Do it after pasting, not before, because that's the moment a clipper makes its swap. Every extra character you check makes a lookalike far harder and more expensive to generate.
3. Check the network. The address has to match the network you're sending on. Our crypto address checker tells you which network an address belongs to and catches typos where the format has a checksum. Be clear about its limits: a poisoned address is a perfectly valid address, so no checker can tell you who owns it. If the networks themselves confuse you, read USDT TRC20 vs BEP20 vs ERC20.
4. Send a small test, and wait for the recipient to confirm it. Then send the rest, copying the address again from the same verified source. Don't copy it from your history after the test: poisoners sometimes strike right after a new payment shows up.

What a test transfer really costs

These numbers are made up to show the maths. Say Halima needs to send 1,500 USDT and the network fee is 1 USDT per transfer.

	Full amount in one go	Test first
Transfers	1	2
Network fees paid	1 USDT	2 USDT
Extra cost of being careful		1 USDT
Lost if the address is wrong	1,500 USDT	5 USDT test amount

One extra fee buys certainty. On a large or first-time payment, that's an easy trade.

Habits that close the gap for good

• Use an address book. Many exchanges and wallets let you save and label withdrawal addresses, and some let you restrict withdrawals to saved addresses only. Add each address once, carefully, after a confirmed test.
• Hide spam and tiny transfers. If your wallet can hide small transactions or unknown tokens, turn that on. It removes the bait from your history.
• Keep the device you use for crypto clean. No cracked software, no pirated games, no APKs from chats. Install apps only from Google Play or the App Store, through the company's own links.
• Never type an address by hand. Typos are the other way funds go astray, and autocorrect doesn't help.
• Ask your payers to do the same. If clients pay you in USDT, tell them to copy your address from your latest invoice, not from a past transaction.

If you've already sent to a lookalike

Blockchain transfers can't be reversed. Look up the transaction on a block explorer to confirm where it went. If the receiving address turns out to belong to an exchange, contact that exchange's support with the transaction hash, though recovery is never guaranteed. If it's a private wallet, the honest answer is that the money is very unlikely to come back, and anyone who promises otherwise for a fee is running a second scam. Our guide to sending crypto to the wrong address covers the options in more detail.

Then check the device for clipboard malware before you send anything else.

Sending to KWIQ

When the address you're sending to is your own KWIQ wallet, open the coin's wallet in the app, copy the deposit address fresh from that screen, run the same checks, and send on the network the app shows. You'll see the rate and the naira amount before you confirm the sale. Get the KWIQ app and make the four checks a habit from your very first transfer.